VDB
RHSA-2023%3A5697
RHSA-2023%3A5697
PUBLISHED
CVSS 6.5 MEDIUM
A flaw was found in the `/v2/_catalog` endpoint in distribution/distribution, which accepts a parameter to control the maximum number of records returned (query string: `n`). This vulnerability allows a malicious user to submit an unreasonably large value for `n,` causing the allocation of a massive string array, possibly causing a denial of service through excessive use of memory.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-prometheus-operator@sha256:fe1a471cb9876327e6e0d8484870c6eecf9a0a6dc07ffeb82d002665923f873d_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-prometheus-operator@sha256:fe1a471cb9876327e6e0d8484870c6eecf9a0a6dc07ffeb82d002665923f873d_arm64, openshift4/ose-prometheus-operator@sha256:fe1a471cb9876327e6e0d8484870c6eecf9a0a6dc07ffeb82d002665923f873d_arm64, * |
| Red Hat | openshift4/ose-csi-livenessprobe-rhel8@sha256:1b4a20817a79e0664b40c8bce10ea75d9a5699aa933ac0db0ec83ab86838e2de_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-livenessprobe-rhel8@sha256:1b4a20817a79e0664b40c8bce10ea75d9a5699aa933ac0db0ec83ab86838e2de_arm64, openshift4/ose-csi-livenessprobe-rhel8@sha256:1b4a20817a79e0664b40c8bce10ea75d9a5699aa933ac0db0ec83ab86838e2de_arm64, openshift4/ose-csi-livenessprobe-rhel8@sha256:1b4a20817a79e0664b40c8bce10ea75d9a5699aa933ac0db0ec83ab86838e2de_arm64 |
| Red Hat | openshift4/ose-operator-lifecycle-manager@sha256:931d47e3c736cb178e4da56895949b5af9f5280a20530f03a1bb415deefb4f4c_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-operator-lifecycle-manager@sha256:931d47e3c736cb178e4da56895949b5af9f5280a20530f03a1bb415deefb4f4c_ppc64le, openshift4/ose-operator-lifecycle-manager@sha256:931d47e3c736cb178e4da56895949b5af9f5280a20530f03a1bb415deefb4f4c_ppc64le, * |
| Red Hat | openshift4/ose-libvirt-machine-controllers@sha256:e5a6e0fc44852cfe85fd0d0780775d62e1b321b5227e6964f5c5d2ff41a0573b_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-libvirt-machine-controllers@sha256:e5a6e0fc44852cfe85fd0d0780775d62e1b321b5227e6964f5c5d2ff41a0573b_ppc64le, openshift4/ose-libvirt-machine-controllers@sha256:e5a6e0fc44852cfe85fd0d0780775d62e1b321b5227e6964f5c5d2ff41a0573b_ppc64le, openshift4/ose-libvirt-machine-controllers@sha256:e5a6e0fc44852cfe85fd0d0780775d62e1b321b5227e6964f5c5d2ff41a0573b_ppc64le |
| Red Hat | openshift4/ose-cli-artifacts@sha256:45c97bdad357b4420d5ad96647567f9973d916e79b4c5861e52d745eac9314f4_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cli-artifacts@sha256:45c97bdad357b4420d5ad96647567f9973d916e79b4c5861e52d745eac9314f4_amd64, *, openshift4/ose-cli-artifacts@sha256:45c97bdad357b4420d5ad96647567f9973d916e79b4c5861e52d745eac9314f4_amd64 |
| Red Hat | openshift4/ovirt-csi-driver-rhel8-operator@sha256:495eca554a8a8f060abc11eaa6c452c6d989773cfec74a56ca0e5bd982403af4_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ovirt-csi-driver-rhel8-operator@sha256:495eca554a8a8f060abc11eaa6c452c6d989773cfec74a56ca0e5bd982403af4_arm64, *, * |
| Red Hat | openshift4/ose-kube-rbac-proxy@sha256:6370980bdcc1fa2b50e973754f8db0d263551043f448338aef496d4f410e9792_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-kube-rbac-proxy@sha256:6370980bdcc1fa2b50e973754f8db0d263551043f448338aef496d4f410e9792_s390x, *, openshift4/ose-kube-rbac-proxy@sha256:6370980bdcc1fa2b50e973754f8db0d263551043f448338aef496d4f410e9792_s390x |
| Red Hat | openshift4/ose-agent-installer-node-agent-rhel8@sha256:599c6c66e4d54ca2293a789c1ca6ff91e7b0644809802d9b627b95981ae471f7_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-agent-installer-node-agent-rhel8@sha256:599c6c66e4d54ca2293a789c1ca6ff91e7b0644809802d9b627b95981ae471f7_amd64, openshift4/ose-agent-installer-node-agent-rhel8@sha256:599c6c66e4d54ca2293a789c1ca6ff91e7b0644809802d9b627b95981ae471f7_amd64, openshift4/ose-agent-installer-node-agent-rhel8@sha256:599c6c66e4d54ca2293a789c1ca6ff91e7b0644809802d9b627b95981ae471f7_amd64 |
| Red Hat | openshift4/ose-prom-label-proxy@sha256:a026f8b1716931f90bd721d0d45c00d27e243994bffcca0b09e6750a5ae88663_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | *, *, openshift4/ose-prom-label-proxy@sha256:a026f8b1716931f90bd721d0d45c00d27e243994bffcca0b09e6750a5ae88663_arm64 |
| Red Hat | openshift4/ose-prometheus-config-reloader@sha256:e00db2c5fa887f822e85cdff4c5c62d5cfe6d84428453aa59217a9856a4669c8_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-prometheus-config-reloader@sha256:e00db2c5fa887f822e85cdff4c5c62d5cfe6d84428453aa59217a9856a4669c8_amd64, openshift4/ose-prometheus-config-reloader@sha256:e00db2c5fa887f822e85cdff4c5c62d5cfe6d84428453aa59217a9856a4669c8_amd64, openshift4/ose-prometheus-config-reloader@sha256:e00db2c5fa887f822e85cdff4c5c62d5cfe6d84428453aa59217a9856a4669c8_amd64 |
| Red Hat | openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:5e485e5fa253c1f6c45f3cca6af6e23ad105870cf45403ab927d341a224fad28_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:5e485e5fa253c1f6c45f3cca6af6e23ad105870cf45403ab927d341a224fad28_ppc64le, *, openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:5e485e5fa253c1f6c45f3cca6af6e23ad105870cf45403ab927d341a224fad28_ppc64le |
| Red Hat | openshift4/ose-cluster-network-operator@sha256:eed9e4b2fba0b3eeb9dd3f658a769f386deea9149add912e64776ff6a81532bb_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-network-operator@sha256:eed9e4b2fba0b3eeb9dd3f658a769f386deea9149add912e64776ff6a81532bb_ppc64le, *, openshift4/ose-cluster-network-operator@sha256:eed9e4b2fba0b3eeb9dd3f658a769f386deea9149add912e64776ff6a81532bb_ppc64le |
| Red Hat | openshift4/ose-csi-external-attacher@sha256:1b2c3c9488f8ca036b58bd9bda8887455eb48d5d232b520f1272794be47e2a2d_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-external-attacher@sha256:1b2c3c9488f8ca036b58bd9bda8887455eb48d5d232b520f1272794be47e2a2d_arm64, openshift4/ose-csi-external-attacher@sha256:1b2c3c9488f8ca036b58bd9bda8887455eb48d5d232b520f1272794be47e2a2d_arm64, openshift4/ose-csi-external-attacher@sha256:1b2c3c9488f8ca036b58bd9bda8887455eb48d5d232b520f1272794be47e2a2d_arm64 |
| Red Hat | openshift4/ose-csi-external-attacher@sha256:066a46740f51fcce1f3f37fdc3897db45d5c5d20e57c560aa94ccbdc946e9b74_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-external-attacher@sha256:066a46740f51fcce1f3f37fdc3897db45d5c5d20e57c560aa94ccbdc946e9b74_s390x, *, openshift4/ose-csi-external-attacher@sha256:066a46740f51fcce1f3f37fdc3897db45d5c5d20e57c560aa94ccbdc946e9b74_s390x |
| Red Hat | openshift4/ose-libvirt-machine-controllers@sha256:3f429d0bef363b43e0bcda933004ac3fddce8ee2d851d21faec3da86e0851a85_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-libvirt-machine-controllers@sha256:3f429d0bef363b43e0bcda933004ac3fddce8ee2d851d21faec3da86e0851a85_amd64, *, * |
| Red Hat | openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:e4e17602dc90977550d762d01967fb44004475abd592591d94df7cfb509cf1a3_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-cluster-csi-snapshot-controller-rhel8-operator@sha256:e4e17602dc90977550d762d01967fb44004475abd592591d94df7cfb509cf1a3_amd64, * |
| Red Hat | openshift4/ose-machine-api-operator@sha256:c335c4abdf474d45874d0cda4268f5f422b957db99136b9842df6f3bcad145ea_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | *, openshift4/ose-machine-api-operator@sha256:c335c4abdf474d45874d0cda4268f5f422b957db99136b9842df6f3bcad145ea_amd64, openshift4/ose-machine-api-operator@sha256:c335c4abdf474d45874d0cda4268f5f422b957db99136b9842df6f3bcad145ea_amd64 |
| Red Hat | openshift4/ovirt-csi-driver-rhel8-operator@sha256:ca5ef570a913ba5d042bdada1e77f9ee578fa93d821c76af925b6375496ac6e8_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ovirt-csi-driver-rhel8-operator@sha256:ca5ef570a913ba5d042bdada1e77f9ee578fa93d821c76af925b6375496ac6e8_s390x, openshift4/ovirt-csi-driver-rhel8-operator@sha256:ca5ef570a913ba5d042bdada1e77f9ee578fa93d821c76af925b6375496ac6e8_s390x, openshift4/ovirt-csi-driver-rhel8-operator@sha256:ca5ef570a913ba5d042bdada1e77f9ee578fa93d821c76af925b6375496ac6e8_s390x |
| Red Hat | openshift4/ose-kube-storage-version-migrator-rhel8@sha256:db14187fbdbb7290a83d417ea7521aee60c8b9bb0029ac9b8dee77b0e764bd79_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-kube-storage-version-migrator-rhel8@sha256:db14187fbdbb7290a83d417ea7521aee60c8b9bb0029ac9b8dee77b0e764bd79_arm64, openshift4/ose-kube-storage-version-migrator-rhel8@sha256:db14187fbdbb7290a83d417ea7521aee60c8b9bb0029ac9b8dee77b0e764bd79_arm64, openshift4/ose-kube-storage-version-migrator-rhel8@sha256:db14187fbdbb7290a83d417ea7521aee60c8b9bb0029ac9b8dee77b0e764bd79_arm64 |
| Red Hat | openshift4/ose-csi-snapshot-validation-webhook-rhel8@sha256:01acf35ef40effe29149e3ca14aac44c5e337263da72e5951dcd09a4016d9ad0_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-snapshot-validation-webhook-rhel8@sha256:01acf35ef40effe29149e3ca14aac44c5e337263da72e5951dcd09a4016d9ad0_amd64, openshift4/ose-csi-snapshot-validation-webhook-rhel8@sha256:01acf35ef40effe29149e3ca14aac44c5e337263da72e5951dcd09a4016d9ad0_amd64, openshift4/ose-csi-snapshot-validation-webhook-rhel8@sha256:01acf35ef40effe29149e3ca14aac44c5e337263da72e5951dcd09a4016d9ad0_amd64 |
…and 1205 more
Timeline
- Oct 18, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 21, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:5697 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://access.redhat.com/security/vulnerabilities/RHSB-2023-003 advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2189886 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=2243296 issue
- https://issues.redhat.com/browse/OCPBUGS-15084 advisory
- https://issues.redhat.com/browse/OCPBUGS-18129 advisory
- https://issues.redhat.com/browse/OCPBUGS-18486 advisory
- https://issues.redhat.com/browse/OCPBUGS-19409 advisory
- https://issues.redhat.com/browse/OCPBUGS-19946 advisory
- https://issues.redhat.com/browse/OCPBUGS-20217 advisory
- https://issues.redhat.com/browse/OCPBUGS-20309 advisory
- https://issues.redhat.com/browse/OCPBUGS-20576 advisory
- https://issues.redhat.com/browse/OCPBUGS-494 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5697.json advisory
- https://access.redhat.com/security/cve/CVE-2023-2253 advisory
- https://www.cve.org/CVERecord?id=CVE-2023-2253 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-2253 advisory
- https://www.openwall.com/lists/oss-security/2023/05/09/1 advisory
- https://access.redhat.com/security/cve/CVE-2023-39325 advisory
…and 6 more